EN RU
List your company
Domain & tech checks

DNS, SSL & headers checker

DNS records, the TLS certificate and the security headers a domain sends — one lookup, resolved from our server.

Check a domain

What one lookup tells you about a domain

Three layers matter when you are checking a partner site, a landing page host, or your own setup. DNS records show where the domain points — the A and AAAA addresses, the mail servers (MX), the authoritative nameservers, the TXT records that carry SPF, DKIM and domain-verification tokens, and any CAA record restricting which certificate authorities may issue for it. The TLS certificate shows who issued it, when it expires, and which hostnames it covers in its SAN list — a mismatch or an imminent expiry is a real availability risk. The security headers show whether the site sends HSTS, a Content-Security-Policy, X-Frame-Options and the rest.

Reading the results

A certificate with under 15 days left is flagged amber and one that has expired is flagged red — sites do forget to renew. Missing security headers are common and not necessarily a problem for a marketing site, but a total absence of HSTS and CSP on a page that takes any user input is worth noting. The Server and X-Powered-By headers hint at the stack. DNS answers come from our server's resolvers, so a result can differ from what your users see if the domain uses geo-DNS or split-horizon; the check is a snapshot, not a monitor.

Frequently asked questions

Which DNS records does it check?
A, AAAA, MX, NS, TXT, CNAME and CAA. TXT is where SPF, DKIM policy and domain-verification strings live; CAA restricts which certificate authorities can issue for the domain; NS are the authoritative nameservers.
Why do my DNS results differ from what I see locally?
The lookup runs from our server's resolvers. If the domain uses geo-based DNS, a CDN, or recently changed records that have not propagated everywhere, our answer can differ from yours. It is also cached for 10 minutes.
What does the certificate "days left" tell me?
How many days until the TLS certificate expires. Under 15 is amber, expired is red. Most certificates auto-renew, but a lapsed certificate makes a site throw a security warning and stops most traffic — it is worth catching early.
Is a missing security header a problem?
It depends on the page. For a static marketing site, missing HSTS or CSP is common and low-risk. For anything that takes user input or handles sessions, the absence of HSTS, CSP and X-Frame-Options is worth raising. This tool reports presence, not a full security grade.
Can I check a subdomain or just the root?
Any hostname — enter www.example.com, shop.example.com or the bare domain. DNS, certificate and headers are all resolved for exactly the host you type.
Why is the certificate section empty for some hosts?
The host may not serve TLS on port 443, may block the connection, or may require SNI the tool did not match. It also skips hosts that resolve to a private or reserved IP as a safety measure.
Does it test my mail deliverability (SPF/DKIM/DMARC)?
It shows the raw TXT records, so you can read the SPF string and a DMARC record if it is at the standard _dmarc name. It does not validate the policy syntax or simulate delivery — a dedicated email-auth checker does that.
Is the domain I check stored?
It is in the URL so results can be shared, and it appears in server logs and a 10-minute result cache. It is not written to a database or reused.

Related tools

Domain age & WHOIS summaryRegistration date, age, expiry, registrar and statusRedirect chain checkerEvery 301/302 hop, status codes and the final URLrobots.txt tester & builderIs a path crawlable for a bot + a form builder
All tools →